Docs

Container Registry

Access control

Enabling public network access

Public network access is disabled by default for newly created Standard Edition instances. If you need to push or pull images via the public network, manually enable public network access and optionally configure a public network access allowlist.

tip

This operation is only applicable to Standard Edition instances. Micro Edition instances have public network access enabled by default and require no additional configuration.

Background

After public network access is enabled, all IP addresses are denied by default, and you must configure an allowlist before you can use it normally. Adding an allowlist involves the following two scenarios:

Scenario	Description	Trigger time
Add when public network access is enabled	When you enable public network access for the first time, the system displays a dialog box that requires you to enter at least one allowlist address. Otherwise, enabling cannot be completed.	Appears automatically when you click the public network access toggle.
Add after public network access is enabled	After public network access is enabled, you can add more allowlist addresses at any time on the Access control page.	Click Add access allowlist on the Public network tab.

You can add an allowlist based on your business needs.

Deny access from all addresses: Leave the field empty.

Allow access from specific addresses: enter the IP addresses (for example, 192.168.0.1) or CIDR blocks (for example, 192.168.1.0/24) that you want to allow through the allowlist.

Separate multiple IP addresses or CIDR blocks with line breaks or commas (,).

When you enter multiple entries, the IP ranges must not overlap.

Allow access from all IPv4 addresses: Enter 0.0.0.0/0.

Prerequisites

You have created a Standard instance. For instructions, see Creating Standard instances or Creating proxy cache registries.

Enable public network access

tip

After you enable public access in the console, it typically takes 3 to 5 minutes for resolution before the instance becomes publicly accessible.

Select the target region in the top navigation bar.

In the left navigation pane, click Instance list. Select an entry point depending on your instance type:

Standard instance: Click Standard instance. Find the target instance and click Enter instance.

Proxy repository: Click Proxy cache. Click the target domain name to enter the instance details page.

In the left navigation bar, click Access control.

Click the Public network tab.

In the upper-right corner of the page, click the Open/Close toggle.

In the confirmation box, click Confirm.

In the Enable public network access dialog box, configure the allowlist addresses.

Click Confirm.

Add a public network access allowlist

After public network access is enabled, you can add more allowlist addresses at any time.

Select the target region in the top navigation bar.

In the left navigation pane, click Instance list. Select an entry point depending on your instance type:

Standard instance: Click Standard instance. Find the target instance and click Enter instance.

Proxy repository: Click Proxy cache. Click the target domain name to enter the instance details page.

In the left navigation bar, click Access control.

Click the Public network tab.

Click Add access allowlist.

Enter the IP address or CIDR block that you want to allow to access. Separate multiple rules with line breaks or commas (,).

Click Confirm.

Last updated: 2026.09.23 14:37:21